public static JwtPayload DecodeToken(string token, string secret, out bool validated) { var jwtPayload = new JwtPayload(); var segments = token.Split('.'); var invalidToken = segments.Length != 3; if (!invalidToken) { try { jwtPayload = JsonConvert.DeserializeObject( Encoding.UTF8.GetString(Base64Decode(segments[1])), typeof(JwtPayload)); var rawSignature = segments[0] + '.' + segments[1]; validated = Verify(rawSignature, secret, segments[2]); } catch (Exception exception) { validated = false; } } else { validated = false; } return jwtPayload; }
public static string EncodeToken(JwtPayload jwtPayload, string secret) { const string algorithm = "HMAC256"; var header = new JwtHeader { typ = "JWT", alg = algorithm }; var jwt = Base64Encode(JsonConvert.SerializeObject(header)) + "." + Base64Encode(JsonConvert.SerializeObject(jwtPayload)); jwt += "." + Sign(jwt, secret); return jwt; }
public IHttpActionResult Login([FromBody] DataModel.SecurityModel.Login _user) { const string errorMessage = "Invalid User Name / Password"; var response = new HttpResponseMessage(); users user = _userRepository.FindBy(x => x.userName == _user.userName).SingleOrDefault(); if (user != null) { if (user.userPassword == _user.userPassword) { string secret = TokenManager.Base64Encode(SecurityConstants.KeyForHmacSha256); var currentTime = (long)(DateTime.Now - new DateTime(1970, 1, 1, 0, 0, 0, 0).ToLocalTime()).TotalSeconds; var payload = new JwtPayload { iss = SecurityConstants.TokenIssuer, sub = user.id.ToString(), iat = currentTime, exp = currentTime + 604800 }; string jwt = TokenManager.EncodeToken(payload, secret); response.StatusCode = HttpStatusCode.OK; response.Headers.Add("Authorization", jwt); return ResponseMessage(response); } } response.StatusCode = HttpStatusCode.Unauthorized; response.ReasonPhrase = errorMessage; return ResponseMessage(response); }